aig-scanner

Name: aig-scanner
Author: Tencent

by Tencent·2mo ago

A.I.G Scanner — AI security scanning for infrastructure, AI tools / skills, AI Agents, and LLM jailbreak evaluation via

Security & ComplianceClaude CodeCodexMedium risk · 中风险open source · 开源

Before you install安装前须知

!Runs shell commands会执行命令

!Needs an API key需要 API Key

!Accesses the network会访问网络

Editor's verdict· 编辑结论

Best for the AI-specific failure modes — prompt-injection vectors, over-broad tool permissions, agent-escape paths, skill supply-chain risk. Catches issues classical app-sec scanners miss because they don't know what an agent or a skill is. Strongest in agent / skill ecosystem audits. Skip it for traditional web-app pentest; api-security-testing is more efficient there.
AI 特有的失败模式上它最强——Prompt 注入面、过宽工具权限、Agent 逃逸路径、技能供应链风险。能抓传统 app-sec 扫描器漏掉的问题，因为它们不懂 agent 和 skill 是什么。Agent / 技能生态审计最合适。传统 Web 应用渗透别用它，那种场景 api-security-testing 效率更高。
— Editorial team · 编辑团队

Install via Skills CLI

Use npx skills add to install this skill into the selected agent. Phase 0 commands are generated from source rules, not verified.

Codex

npx skills add https://github.com/Tencent/AI-Infra-Guard/tree/main/skills/aig-scanner -g -a codex -y

Drop `-g` to install project-locally

✓

Best for适合什么场景

High-star GitHub skill discovery candidate.

✗

Not for不适合什么场景

Sensitive or production workflows without local review.

vs alternativesvs 其他选择

Full compare table完整对比表 →

#1api-security-testing

API安全测试的专业技能和方法论

3.7k stars

diff · 差异Best for the OWASP-API-Top-10 workflow — auth bypass, broken object-level authorization, mass assignment, injection paths through API surfaces. Methodology-driven, not just a scanner. Strongest before a major API release or annual security review. Skip it for infrastructure security (TLS, secret rotation); that's a different toolchain.

#3wooyun-legacy

WooYun business logic vulnerability methodology — 22,132 real cases across 6 domains (authentication bypass, authorizati

1.6k stars

diff · 差异Best for grounding security review in real-world breach patterns — 22,000+ historical Chinese-internet security cases covering business-logic vulnerabilities, IDOR, race conditions, design-level data leaks. A reference corpus, not a scanner. Strongest as input to a threat-model exercise. Skip it as a standalone scanner; pair with api-security-testing for the actual review.

#4threat detection

Use when hunting for threats in an environment, analyzing IOCs, or detecting behavioral anomalies in telemetry. Covers…

14k stars

diff · 差异Use when hunting for threats in an environment, analyzing IOCs, or detecting behavioral anomalies in telemetry. Covers hypothesis-driven threat hunting, IOC sweep generation, z-score anomaly detection, and MITRE ATT&CK-mapped signal prioritization.

Side-by-side compare维度对比

Key differences with same-lane alternatives

	this skill · 当前aig-scanner	api-security-testing	wooyun-legacy	threat detection
Rating · 评分	—	—	—	—
Stars · 星标	3.6k	3.7k	1.6k	14k
Risk · 风险	Medium risk · 中风险	Medium risk · 中风险	Low risk · 低风险	Medium risk · 中风险
Best for · 最适合	High-star GitHub skill discovery candidate.	API安全测试的专业技能和方法论	WooYun business logic vulnerability methodology — 22,132 real cases across 6 domains (authentication bypass, authorizati	Use when hunting for threats in an environment, analyzing IOCs, or detecting behavioral anomalies in telemetry. Covers…
Not for · 不适合	Sensitive or production workflows without local review.	Workflows that require stronger human review than this catalog entry documents.	Workflows that require stronger human review than this catalog entry documents.	Workflows that require stronger human review than this catalog entry documents.

Audit notes审计备注

last reviewed 2026-06-10 · 复查

Source源码open on GitHub · 公开✓

Author作者community · 社区!

Network网络访问network access · 需联网✓

Filesystem文件写入writes to repo · 写入仓库!

Dependencies依赖many deps · 依赖较多✓

Telemetry遥测none · 无✓